From inventing the bulb to defying possibilities with the touch of a button, mankind has come a long way in technology to reach where we are today. Globally, there are 5.19 billion internet users1, and the tremendous volume of data exchanged over cyberspace emphasizes the need to protect sensitive private data from exploitation by institutions. According to UNCTAD2, 137 out of 194 nations have legislation to protect the data and privacy of their citizens on the internet.
Having legislation and regulating bodies is essential to ensuring devious cyber activities are kept in check. The Indian Legislator has been expeditiously working on the drafting of the Data Protection Law. The recently unveiled Digital Personal Data Protection Bill, 2023, marks a significant milestone in India's legislative journey, following numerous previous endeavours and extensive consultations with stakeholders from diverse domains, greatly influencing its formulation.
Right to Privacy vis-à-vis Puttaswamy Judgment
In the well-known Supreme Court decision of K.S. Puttaswamy v. Union of India3, which recognized "privacy" as intrinsic to the right to life and liberty, guaranteed by Article 21 of the Indian Constitution, establishing "right to privacy" as a fundamental right, the groundwork for a single statute of legislation for the protection of data in India was laid down in 2017. The Puttaswamy Judgment touches on protections for people in the private realm while primarily addressing the range of rights of a citizen as opposed to the State. The Supreme Court found that the State had a positive burden of upholding and sustaining this dignity and connected the value of privacy to the value of individual dignity. The Puttaswamy Judgment serves as the basis for both establishing a prohibition against privacy-violating State activities and the State's duty to regulate private contracts and private data sharing in order to protect individual privacy.
Timeline of the Bill
The first draft of the Personal Data Protection (PDP) Bill was proposed by the Justice Shrikrishna Committee in 2018. Since then, the legislative process has witnessed a series of turbulent turns, starting with the introduction of the PDP Bill 2019 in the Lok Sabha. The bill was subsequently sent to the Joint Committee for review but was eventually withdrawn in December 2021. The following year, the Ministry of Electronics and Information Technology (MeitY) released another Draft of the Digital Personal Data Protection Bill, (DPDP) 2022, which was made open for public comment in November 2022.4 However, this version received several criticisms and businesses complained about onerous provisions on cross border data transfer.
Moving on to the present timeframe, the Union Communications, Electronics, and Information Technology Minister Ashwini Vaishnaw on 3rd August, 2023 introduced the new bill in the Lok Sabha during Monsoon session of Parliament.5 The long journey of the Bill was foreseeable since it is arduous to strike the perfect balance between the Fundamental Right to privacy along with the permissible limitations linked to this entitlement, business feasibility, and the international criteria for being recognized as an appropriate jurisdiction for data processing.
The New Road: Mediation
In a progressive step towards strengthening India's data protection framework, the Digital Personal Data Protection Bill 2023 reflects a notable emphasis on Mediation as an Alternate Dispute Resolution (ADR) mechanism. This emphasis signifies the legislature's recognition of Mediation as an effective means to address data-related disputes while promoting fair and amicable resolutions.
Comparing the language between the 2022 and 2023 versions of the bill reveals a significant shift in focus. Section 23 of the 2022 bill provided the Board with the discretion to direct parties towards mediation or any other dispute resolution process if deemed appropriate. However, in the 2023 bill, the language has been further refined in Section 33, clearly stating that if the Board believes a complaint may be better resolved through mediation, it can direct the concerned parties to attempt mediation, leaving little room for ambiguity. This explicit inclusion of mediation in the text underlines its growing importance as a preferred ADR mechanism in data protection matters.
Furthermore, the recent passage of the Mediation Bill 2021 by the Rajya Sabha offers additional evidence of the legislature's dedication to promoting mediation as an integral part of India's legal landscape. The Mediation Bill seeks to provide a comprehensive regulatory framework for mediation, bolstering its credibility as a legitimate dispute resolution process. With the establishment of the Mediation Council of India and provisions for pre-litigation mediation and legally binding mediated settlement agreements, the Mediation Bill reinforces the government's commitment to make mediation an acceptable and cost-effective means of resolving disputes.
The Balancing Act
The unveiling of the Digital Personal Data Protection Bill, 2023, marks a momentous step in India's legislative journey towards protecting individuals' data privacy rights. Drawing inspiration from the landmark Puttaswamy Judgment, which recognized the right to privacy as a fundamental right, the new bill brings redefined concepts and provisions that align with the evolving data protection landscape.
One striking feature of the 2023 bill is its strong emphasis on Mediation as an Alternate Dispute Resolution mechanism. The legislative shift from the 2022 version, coupled with the recent passage of the Mediation Bill 2021 by the Rajya Sabha, showcases the government's earnest efforts to promote mediation as an effective means of resolving data-related disputes. With the explicit inclusion of mediation in the text and the establishment of the Mediation Council of India, the bill reinforces mediation's credibility as a preferred method for fair and amicable resolutions.
As India progresses in the digital era, the new Digital Personal Data Protection Bill, 2023, stands as a testament to the nation's commitment to safeguarding data privacy while actively embracing mediation as an instrumental tool for resolving data disputes. By creating a balance between individual privacy rights and business feasibility, this bill ushers in a new era of data protection in the country, inspiring confidence among its citizens and businesses alike. With the combined efforts of the legislative and mediation frameworks, India is poised to set new standards for data protection and dispute resolution in the global arena.
Footnotes
1. Internet and social media users in the world 2023, Statista (2023), https://www.statista.com/statistics/617136/digital-population-worldwide/#:~:text=Worldwide%20digital%20population%202023&text=As%20of%20April%202023%2C%20there,population%2C%20were%20social%20media%20users.
2. Data Protection and Privacy Legislation Worldwide, United Nations Conference on Trade and Development (2023), https://unctad.org/page/data-protection-and-privacy-legislation-worldwide
3. Justice K.S. Puttaswamy (Retd.) & Anr. vs. Union of India & Ors., AIR 2017 SC 4161.
4. Ministry of Electronics and Information Technology, The Digital Personal Data Protection Bill, 2022, https://www.meity.gov.in/writereaddata/files/The%20Digital%20Personal%20Data%20Potection%20Bill%2C%202022_0.pdf.
5. IT Minister Ashwini Vaishnaw introduces Digital Personal Data Protection Bill, 2023 in Lok Sabha, Newsonair.gov.in (2023), https://newsonair.gov.in/Main-News-Details.aspx?id=465464
To view original article, please click here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.